CloudThinker for MSPs
Frontier Investigation Agents,for every client you manage
Take on more clients without hiring at the same rate. Each client gets its own workspace, and your engineers work all of them from one login.
Agents find the why behind each client's incidents, cloud bill and security findings, using only that client's connections. A new client doesn't mean a new toolset.
- Client workspaces
- One workspace per client. Its connections, credentials and memory belong to that workspace.
- Your organization
- SSO, SCIM, audit logs and one credit pool, set up once.
- Your delivery team
- One login across clients, with a role in each, from Admin to Viewer.
Why MSP operations stall
Every new clientadds another console.
- A toolset per client
- Each client brings its own cloud accounts, monitors and runbooks, so engineers switch context all day.
- Pages from every estate
- Alerts from every client land on the same on-call rotation, and each one starts with digging through logs by hand.
- Margins tied to headcount
- When every investigation runs by hand, more clients means more engineers, and the margin on each contract shrinks.
- Clients that can't mix
- One client's credentials, data and conversations can't reach another's, and client auditors ask you to show it.
The value for an MSP
Grow the client listwithout growing the team at the same rate.
- More clients per engineer
- Agents run the first investigation on every client's alerts, bills and findings, so engineers start from a cause with evidence, not a blank log search.
- New services to sell
- Add cost optimization, application security testing and code review to your catalog. Agents run the checks and draft the fixes, and your engineers decide what merges and what runs.
- One standard everywhere
- Every client runs on the same platform, approval policy, commands and skills, so any engineer can pick up any client.
- Costs you can bill back
- Your plan is one flat monthly price. Usage shows the credits each client workspace used over any date range, so you can price each contract on real usage.
At a glance
Built for many clients.Governed from one organization.
- ∞
- Members on every paid plan, so adding engineers or client viewers doesn't change your price
- 99.9%
- Uptime SLA on Scale. 99.95% on Enterprise
- 63%
- Lower tooling cost at MSM, a digital transformation partner
CloudThinker was the first platform that connected delivery quality, incident response, pentesting and compliance under one identity and one audit log. That is what our point tools could not do.
Engineering leadershipHow it works
One workspace per client.One team across all of them.
- Isolated by default
- Each client workspace has its own connections, credentials, memory, knowledge and conversations. Agents in one workspace can't use another's.
- A role per client
- Make an engineer Admin on the clients they own and Viewer on the rest. When someone leaves, one removal takes them out of every client.
- Alerts per client
- Point each client's Datadog, Grafana or PagerDuty at a webhook in its workspace, so its incidents open there.
- A channel per client
- Map a channel in your Slack, a team in your Microsoft Teams or a Google Chat space to each client's workspace, and send its notifications there.
- Approvals per client
- Give a client with strict change control a stricter approval mode than one that wants more automation, and import your standard policy into each new client as YAML.
- A budget per client
- Set a monthly credit limit for each client workspace, and choose whether hitting it pauses paid work or only alerts the Owner.
- Reports with a brand
- Put your logo, name and colors, or the client's, on each workspace's PDF reports and shared report links.
- Guardrails set once
- Lock data-masking guardrails for every client workspace from the organization, so no workspace can turn them off.
Infra to app
Every layer of each client's stack,from that client's workspace.
01Cloud and servers
AWS, Azure, Google Cloud, FPT Cloud, OpenStack, VMware vCenter, SSH
Inventory resources, audit access, read spend and check disk, memory and services on each server.
02Kubernetes and platform
Kubernetes, Rancher, Argo CD, HCP Terraform, Pulumi, Ansible AWX
Triage failing pods and node pressure, find out-of-sync apps and check recent infrastructure runs.
03Databases and queues
PostgreSQL, MySQL, SQL Server, MongoDB, Redis, Kafka, RabbitMQ
Find slow queries, suggest indexes and check replication health, queue depth and consumer lag.
04Monitoring and logs
Datadog, Grafana, Prometheus, New Relic, Dynatrace, Splunk, Zabbix, PRTG
Take in the client's alerts, then query its metrics, logs and traces to find the cause.
05Applications and APIs
Sentry, Rollbar, Honeycomb, Cloudflare, Vercel
Tie new errors to a release, follow a trace to the failing span and triage failed deployments.
06Code and delivery
GitHub, GitLab, Bitbucket, Azure DevOps, Jenkins, CircleCI, SonarQube
Review pull requests, triage failed builds and explain failed quality gates.
Connect each client with a read-only credential and agents can only read. If you widen access later, each change an agent makes goes through that client's approvals. Your own tools connect over MCP.
See all connectionsOutcomes per client
Cost, uptime, security and delivery,reported per client, with evidence.
- CostOptimize
Finds savings in each client's AWS, Azure and Google Cloud bill, flags daily cost spikes and scores each account's Cost Health.
What you report
Cost reports on a daily, weekly or monthly schedule, with potential monthly savings.
- UptimeResolve
Groups each client's alert noise into clusters, investigates the incidents that matter and posts the cause, with evidence, to the client's channel.
What you report
Mean time to resolve, reliability by service and the share of root causes your engineers confirmed.
- SecurityCyber
Tests each client's web apps and APIs on domains you've verified, backs every verified finding with request and response proof, and drafts the fix as a merge request.
What you report
A PDF of the findings you select, or a custom report in the client's own format.
- DeliveryReview
Reviews each client's pull requests before they merge, and explains failed builds and quality gates.
What you report
Weekly Technical and Product PDFs per repository, plus comments on every pull request.
One operating rhythm, run in every client workspace.
Automations run agent instructions on a schedule or an event. Set them up in each client's workspace from your standard instructions, and every write still goes through that client's approvals.
- Always on
Each client's alerts open incidents in its workspace, and Resolve starts the investigation.
- Daily
An automation checks each client's costs for anomalies and posts what it finds to the client's channel.
- Weekly
A weekly incident digest sums up each client's incidents and repeat causes, and the Optimize weekly digest posts Cost Health and new savings to its channel.
- Monthly
A scheduled cost report and a scheduled security test feed each client review.
Onboarding a client
Four steps per client.The same four every time.
- Step 1
Create
Create a workspace named for the client, such as retail-prod, add the engineers who serve it, and import your standard approval policy.
- Step 2
Connect
Add the client's cloud accounts, clusters and monitors, with read-only credentials to start.
- Step 3
Route
Point the client's alerts at its workspace, map its chat channel and set its credit limit.
- Step 4
Report
Brand the workspace, then share reports by link or add the client's team as Viewers.
FAQ
Questions from MSPs
Add clients, not consoles.
Frontier Investigation Agents work every client estate from one organization, with each client in its own workspace. You decide what runs on its own and what waits for approval.